171
Arch Linux Now Believes Malware Incident Under Control: More Than 1,500 Affected Packages
(www.phoronix.com)
this post was submitted on 13 Jun 2026
171 points (98.9% liked)
Linux
66015 readers
389 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 7 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Is thr solution truly to tell people to read the build instructions and decide if a package is safe? I'm not an arch user, but I've used nixos and assessing nixpkg before installation gets old real quick real fast. Somehow I really doubt telling an average user to assessing pkgbuild on their own will be very effective.
It is a different situation, because Nix packages are part of the Nix distributdis, while AUR packages are not part of Arch. AUR packages are more like Ubuntu ppa's, you can add and run them, but you are on your own risk.
Also,it is a huge number of packages (about 114,000) which are many used by relatively few people. Each arch user has in average probably only a few of these.
So, it makes sense that users review them by themselves. If you can't do that, you should probably not use them.
It is Archlinux' mission statement that its average user knows how to do such things. The installation process is based on handling PKGBUILDS. AUR helpers are explicitely unsupported.
The onus here is on Arch-based distros that decide this vast collection of build scripts equals a software repo, is a good "selling" point, and decide to integrate it into the distro or even the package management.
All that said, the AUR is not the only user repo that is plagued. These sort of malware attacks need to be addressed somehow.
Well damn, I wouldn't have expected that average arch users needed to know how to assess pkgbuilds given how enthusiastically arch users have been trying to sell the distro to first time linux users and other newbies.
Arch Linux is not really made for the average user, and using code from AUR even less so. I doubt it that everyone using Arch+AUR or CachyOS or youname it is served well by this.
And making it kind of accepted norm to run untrusted code as a non-technical user will bite the Arch community in the ass. For Arch, it is a phony measure of success to have many such users.
This is also a result of Windows user attitudes leaking into the Linux universe. You need to discern code and data, and you can't run untrusted code, period.